Virus need help flashing

[mustang7757]

View attachment 335425

Thank you !

Is this from a file manager you downloaded? Can you find this files on the device?

 

[bionix208]

Thank you !

Is this from a file manager you downloaded? Can you find this files on the device?

Yep,it's the file manager and offcource i can find it.

 

[mustang7757]

Yep,it's the file manager and offcource i can find it.

If you activate this file manager can you remove the virus?

 

[bionix208]

If you activate this file manager can you remove the virus?

I don't know where's located.
It's hiding in android system (the process).

 

[mustang7757]

I don't know where's located.
It's hiding in android system (the process).

Ok, can you explain little more how you mentioned you identified it but cant remove it?

 

[bionix208]

I accidentally installed an firewall (No root firewall).
When i opened asked me to allow/block an incoming connection from an ip and the process was android system.
Offcource i blocked it.
Then it asked me to allow/block and the process was the same.
When i blocked them it also asked me to do than again,but the ip was the same.
And then i installed an app (Network connections).
I opened it and saw 5 or more connections that was behind proxy (i traced them and they were from hotspot shield vpn .... )
So i searched in internet with the symptoms of my phone and found that the virus is Remote administration tool.

 

[mustang7757]

To me it doesn't sound like anything got installed to remotely go into your phone, if someone had remote access they would lock you out and take what they want from your device

 

[bionix208]

To me it doesn't sound like anything got installed to remotely go into your phone, if someone had remote access they would lock you out and take what they want from your device

Yep,exactly the virus gives full control of the phone.

 

[mustang7757]

Yep,exactly the virus gives full control of the phone.

Do you have any weird activity going on with your device? Or any account hacked?

 

[bionix208]

Do you gave any weird activity going on with your device? Or any account hacked?

Someone just control my phone remotely (my phone settings has changing without i even touch the phone,battery drain so quicky that usual,my apps has closing unexpectedly,also got alerts from gmail that someone has been logged in my acc from Windows machine etc etc.

 

[B. Diddy]

Still waiting to hear what exact malware was identified by your security app.

The behavior you're describing doesn't necessarily mean malware. What settings are changing? Regarding the battery, what do your battery stats tell you? Also, check the battery health using AccuBattery -- if it's below 90%, it would not be unusual to start seeing faster battery drain.

Apps closing unexpectedly could just be poor coding. Which apps are closing?

You never log into your Google account on a Windows machine? Does this still happen even after changing your password (making sure it's complex or random enough that it'd be impossible to guess), and making sure you have 2-factor authentication turned on?

 

[mustang7757]

Someone just control my phone remotely (my phone settings has changing without i even touch the phone,battery drain so quicky that usual,my apps has closing unexpectedly,also got alerts from gmail that someone has been logged in my acc from Windows machine etc etc.

I have to agree with b.diddy

 

[bionix208]

It's so hard to proof that im infected with it since any av program does not detect it.
Someone just has been changed the settings of the brightness,the sound.Opened even browser with random music, start procesess like gallery and camera.
When i play games and just browse over the internet.Both just close without any error.
I must say that is real thing happening and im not paranoid.
And yes i'm using linux and my phone only.

 

[mustang7757]

It's so hard to proof that im infected with it since any av program does not detect it.
Someone just has been changed the settings of the brightness,the sound.Opened even browser with random music, start procesess like gallery and camera.
When i play games and just browse over the internet.Both just close without any error.
I must say that is real thing happening and im not paranoid.
And yes i'm using linux and my phone only.

Its just i dont see enough evidence here thats says yes you been hacked remotely or virus , you would have far worse things happening, how long this been happening?

 

[bionix208]

From 4-5 months.

 

[mustang7757]

You would see far worse things being this long ,i think your phone is misbehaving for sure

 

[bionix208]

Thanks for your patience and time guys.
How i can reinstall the firmware?

 

[mustang7757]

Thanks for your patience and time guys.
How i can reinstall the firmware?

You can try here or xda forums for your device
https://huaweiflash.com/how-to-flash-huawei-p10-lite-stock-firmware-all-firmwares/

 

[B. Diddy]

It's so hard to proof that im infected with it since any av program does not detect it.
Someone just has been changed the settings of the brightness,the sound.Opened even browser with random music, start procesess like gallery and camera.
When i play games and just browse over the internet.Both just close without any error.
I must say that is real thing happening and im not paranoid.
And yes i'm using linux and my phone only.

Is Adaptive Brightness turned on?

Clear your browser's browsing history (including cookies) "from the beginning of time."

It's not unusual for processes to be automatically started in the background by the system -- that's normal for Android. Recall that Android is not like Windows. With Android, the system will often automatically open and cache apps into RAM based on the apps and their usage patterns. It doesn't mean that some malicious agent is opening them.

Have you changed your Google password yet and made sure 2-factor authentication is on?

Also, does this happen in Safe Mode? https://safemodewiki.com/how-to-enable-safe-mode-on-huawei-p10-lite/

 

[Mooncatt]

I accidentally installed an firewall (No root firewall).

Not sure how you accidentally install a firewall app, but deleting it should have been easily done without ever opening or interacting with it. If you didn't want it, opening it should've been the last thing to do.

When i opened asked me to allow/block an incoming connection from an ip and the process was android system.
Offcource i blocked it.
Then it asked me to allow/block and the process was the same.
When i blocked them it also asked me to do than again,but the ip was the same.

The firewall app was likely setting up something similar to a vpn to route all incoming traffic through the app to monitor/block as needed, so you would have needed to allow that IP for the app to work properly. This is nothing scary.

And then i installed an app (Network connections).
I opened it and saw 5 or more connections that was behind proxy (i traced them and they were from hotspot shield vpn .... )

Hotspot shield vpn would be an app installed on your phone, working similar to a firewall. If you accidentally installed a firewall, I'd check to see if you accidentally installed a VPN service.

So i searched in internet with the symptoms of my phone and found that the virus is Remote administration tool.

"Remote administration tool" is a generic term for a class of software that can be used for good (I.e. Tech support) or bad (hacking). To say the specific name of a virus is Remote Administration Tool is not correct. When you start searching for topics on the subject, you'll get results going both ways, but even searching by symptoms can give you misleading results. When it comes to Android, hacking is usually the last thing on the list to consider. As B. Diddy pointed out, many of your concerns can be explained as benign issues. It looks like your phone is also on the lower end of the spectrum of Android phones. Those cheap phones, even the lower tiers of name brand manufacturers, are also more prone to simply being glitchy.